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I CLAIM: 

1 . A method for detecting unauthorized use of a wireless local area network 
having at least one mobile unit that communicates with at least one access point, 
comprising: 

accumulating first network traffic data at a mobile unit; 

accumulating second network traffic data at an access point; 

communicating said first and second traffic data to a computer; and 

correlating said first and second traffic data in said computer to identify non- 
correlated traffic data and signaling an alarm condition when said non-correlated traffic 
data exceeds a threshold portion of said traffic data. 

2. A method as specified in claim 1 wherein said first traffic data includes 
number of transmitted messages for said mobile unit. 

3. A method as specified in claim 2 wherein said first traffic data includes 
destination address of said transmitted messages. 

4. A method as specified in claim 1 wherein said first traffic data includes 
number of received messages for said mobile unit. 

5. A method as specified in claim 4 wherein said first traffic data includes source 
address of said received messages. 

6. A method as specified in claim 1 wherein said first traffic data includes a 
record of association requests of said mobile unit with said access point. 

7. A method as specified in claim 1 wherein said first traffic data includes a 
record of disassociation transactions. 
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8. A method as specified in claim 1 wherein said first traffic data includes 
number of broadcast and multicast frames received by said mobile unit. 

9. A method as specified in claim 1 wherein said first traffic data includes a 
record of authentication requests. 

10. A method as specified in claim 1 wherein said second traffic data includes 
number of transmitted messages for said access point. 

1 1 . A method as specified in claim 10 wherein said second traffic data includes 
destination address of said transmitted messages. 

( 12. A method as specified in claim 1 wherein said second traffic data includes 
number of received messages for said access point. 

13. A method as specified in claim 10 wherein said second traffic data includes 
source address of said received messages. i 

14. A method as specified in claim 1 wherein said second traffic data includes a 
record of association requests of mobile units with said access point. 

15. A method as specified in claim 1 wherein said second traffic data includes a 
record of disassociation transactions. 

16. A method as specified in claim 1 wherein said second traffic data includes 
number of broadcast and multicast frames sent by said access point. 

17. A method as specified in claim 1 wherein said second traffic data includes a 
record of authentication requests. 

18. A method as specified in claim 1 wherein said communicating said traffic 
data to a computer is repeated on a periodic basis. 
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19. A method as specified in claim 1 wherein said communicating said traffic 
data to a computer is in response to a command signal from said computer. 

20. A method for detecting unauthorized use of a wireless local area network 
having at least two mobile units that communicate with at least one access point, 
comprising: 

accumulating first network traffic data at a first mobile unit; 

accumulating second network traffic data at a second mobile unit; 

communicating said first and second traffic data to a computer; and 

correlating said first and second traffic data in said computer to identify non- 
correlated traffic data and signaling an alarm condition when said non-correlated traffic 
data exceeds a threshold portion of said traffic data. 

21 . In a mobile unit having a processor and a radio for communicating with a 
computer, the improvement wherein said processor is arranged to accumulate traffic data 
representing communications with access points connected to said computer and to 
communicate said accumulated traffic data as a message to said computer. 

22. A system for detecting unauthorized use of a wireless local area network, 
comprising: 

at least one mobile unit; 

at least one access point; and 

at least one server computer, 
wherein first network traffic data is accumulated by said at least one mobile unit, 
second network traffic data is accumulated by said at least one access point, said first and 
second network traffic data are communicated to said at least one server computer, said 
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first and second network traffic data are correlated by said at least one server computer to 
identify non-correlated traffic data, and an alarm condition is signaled when said non- 
correlated traffic data exceeds a threshold. 
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